Can you recover overwritten files?
Short answer
Usually no. Once new data has been written over the space a file occupied, the original bytes are gone and nothing can bring them back. A partly overwritten file is different: a scan may still find the surviving part, but it often returns as a broken fragment, a photo that opens in part or a video that stops midway. On SSDs, TRIM shortens the window further. The one step that always helps: stop writing to the drive now.
Usually, no. Once new data has been written over the space a file occupied, the original bytes are gone, and nothing brings bytes back once they are no longer on the disk. A file that has been only partly overwritten is a different case: a scan may still find the surviving part, but what comes back is usually a broken piece rather than the whole file. Either way, one step helps immediately: stop using the drive.[1][2]
What overwriting does to a deleted file
Deleting and overwriting are different events. Deleting removes the record that says where the data lives: CGSecurity notes that the name, date, size and location of the first data block are all lost at that point, while the bytes themselves sit on the disk until the drive reuses that space. Overwriting is the step that destroys. When new data is written to those same places, the old content no longer exists on the drive at all.[1]
What actually happens when you delete a file
Partial overwrites: pieces, not files
When only part of a file has been overwritten, recovery software can still find what remains, and what it returns is the surviving fraction. PhotoRec's documentation is an honest example: it hands back whole files when the data is not fragmented, may cut a recovered file off at the size its header declares, and discards anything that comes back smaller than that. In practice that means photos that open in part, videos that stop midway, and documents your software refuses to open.[1]
SSDs: a window that closes faster
On a solid state drive there is a second clock running. Microsoft documents TRIM as the notice Windows sends an SSD saying that sectors are no longer needed and can be purged, and states that NTFS sends it for ordinary operations such as deleting a file, with trim switched on by default. The company's guidance to developers is blunt about the result: trimmed extents are permanently removed from the storage media. A deleted file on a typical internal SSD may therefore be unrecoverable within moments.[2][3]
Do not write anything more to the drive you want to recover from. CGSecurity tells anyone recovering files to save nothing further to the affected device, because every new save may overwrite the lost data. That includes installing recovery software onto the same drive, editing documents in place, or letting the system save anything new there. A scan should read the drive without writing to it, as PhotoRec itself does; if you can, work from another computer.[1]
What nobody can promise
It would be convenient if a tool or a laboratory could put overwritten bytes back, but neither CGSecurity's documentation nor Microsoft's describes a technique that does, and neither quotes success rates for the case. The nearest official anchor is indirect: NIST's media sanitisation guidance defines sanitisation as rendering access to target data infeasible for a given level of effort, a question of effort rather than a promise of restoration, and it is a standard for destroying access to data, not a recovery manual. Treat anyone who promises full recovery of overwritten data with caution, and avoid the opposite mistake too: a file that has only been partly overwritten may still be worth scanning for.[4][1]
When recovery software makes things worse
Sources
Facts on this page are cited to the publishers’ own documentation.
- [1] CGSecurity — PhotoRec. captured 2026-09-12.
- [2] Microsoft — New API allows apps to send TRIM and unmap hints. captured 2026-09-12.
- [3] Microsoft — fsutil behavior (Windows command reference). captured 2026-09-12.
- [4] NIST Computer Security Resource Center — Guidelines for Media Sanitization (SP 800-88 Rev. 2). captured 2026-09-13.